Cybersecurity Statistics 2025: The Alarming Truth

Introduction

The cybersecurity landscape continues to evolve at breakneck speed, with both the scale of threats and the sophistication of attacks expanding globally. Whether it’s a financial services firm defending against AI‑powered phishing or a manufacturing plant recovering from a major ransomware event, the ramifications are real and pervasive across industries. This article will unpack key statistics to shed light on where we stand and invite you to explore deeper insights ahead.

Editor’s Choice

Here are seven standout metrics that set the tone for cybersecurity in 2025:

• $10.5 trillion: Projected annual global cost of cybercrime by 2025.
• 72% of organizations report heightened cyber risk over the past year.
• 1,636 weekly attacks per organization in Q2 2024 for organizations experiencing elevated threat volumes.
• $16 billion+ in reported losses from cybercrime in 2024 via the U.S. Federal Bureau of Investigation (FBI) internet crime report.
• 59% of organizations were hit by ransomware in 2023.
• 28% of malware cases in 2024 were ransomware.
• 30% increase in global cyber attacks in Q2 2024.

Recent Developments

• 72% of organizations say cyber risk increased in the last year.
• 54% of organisations identify supply‑chain vulnerabilities as their biggest barrier to cyber resilience.
• 79% of detections in 2024 were malware‑free techniques, signalling that attackers favour stealth.
• 150% increase in China‑nexus cyber activity.
• 35% of small organisations believe their cyber resilience is inadequate.
• 30% of organisations globally reported weekly attack volumes of ~1,636 in Q2 2024.
• The rise of generative AI is flagged as a major emergent threat across reports.
• Organisations in regions such as Africa (36%) and Latin America (42%) are more likely to lack confidence in national response capabilities compared with North America (15%).

Cybersecurity Overview

• On average, a cyber attack occurs every 39 seconds (≈ 2,244 per day).
• Global cybercrime costs are growing at ~15% per year ahead of 2025.
• 81% of companies rate cybersecurity as a high priority, but only 68% rate their organisation as highly capable.
• The average cost of a breach in 2024 was $4.88 million.
• 52% of organizations affected by an incident said it cost at least $300,000.
• 46% of all emails in 2024 were spam.
• 86% of malware in one year was delivered via email.
• 63% of ransomware attackers demanded $1 million+, 30% demanded over $5 million.

Global Cybercrime Costs

• Global costs of cybercrime are projected at $10.5 trillion annually by 2025.
• Other estimates suggest up to $12 trillion by 2025.
• The FBI’s 2024 report shows $16 billion+ in reported losses.
• Cybercrime cost growth rate: ~10% year‑over‑year.
• Cybercrime’s projected burden by 2027: up to $23 trillion, a 175% increase since 2022.
• Only about 2% of illicit proceeds are recovered by law enforcement.
• Business Email Compromise (BEC) scams have cost over $55 billion in a decade.
• Crypto‑crime received at least $40 billion in stolen funds in 2024.

Frequency of Cyber Attacks

• Attacks occur every 39 seconds, equating to ~2,244 per day.
• Weekly attacks per organisation: ~1,636 in Q2 2024 (a 30% increase from prior).
• 59% of organisations were hit by ransomware in 2023.
• In the U.S., reported ransomware attacks increased by 149% year‑over‑year in early 2025.
• 67% attack rate in organisations with >$5 billion revenue.
• Email remains a dominant vector; correspondingly, spam represented ~46% of all email in 2024.
• More than 52% of organisations with a cybersecurity incident said the cost was $300K or more.
• Global cyber attacks rose by ~30% in Q2 2024.

Ransomware Statistics

• Ransomware affects ~72.7% of organisations globally.
• Global ransomware damages are expected to reach $57 billion in 2025.
• Average cost of ransomware recovery in 2024: $3.58 million.
• Ransomware accounted for 28% of malware cases in 2024.
• U.S. ransomware incidents up 149% in early 2025.
• In 2023, organisations with >$5B revenue had a 67% likelihood of being hit.
• Projected that a ransomware attack will occur every 2 seconds by 2031.

Phishing and Social Engineering Statistics

• 1,003,924 phishing attacks occurred in Q1 2025.
• 3.4 billion phishing emails are sent every day worldwide.
• 36 % of all cybersecurity breaches involve phishing.
• Around 80–90 % of phishing attacks in 2025 are projected to be AI‑enabled.
• The median time to click a phishing link is just 21 seconds.
• BEC attacks represent around 6 % of all malicious emails.
• 30.9 % of phishing attacks targeted online payments and banking.
• Mobile phishing (smishing) now comprises 41 % of mobile threats.
• Only 46 % of users could correctly identify an AI‑generated phishing email.

Data Breach Statistics

• The global average cost of a data breach in 2025 is US$4.4 million.
• Breaches across multiple environments averaged US $5.05 million.
• Nearly 30 % of all data breaches involve a third‑party.
• Each record costs on average US$165.
• Organizations with fewer than 500 employees spent 13.4 % more on breach remediation.
• 68 % of breaches involve human error or social engineering.
• Consumer losses in the U.S. were US $16.6 billion in 2024.
• Multi‑environment breaches averaged a 276-day lifecycle.

Malware Statistics

• Ransomware accounted for 28 % of malware cases in 2024.
• 39 % of companies reported malware attacks.
• 40 % of malware attacks result in data theft.
• 161 vulnerabilities exploited in H1 2025 were linked to malware.
• Over 560,000 new malware pieces are detected daily.
• 83 % of new malware targets the Windows OS.
• Malware incidents cause months‑long business impacts.
• One campaign infected over 394,000 Windows PCs globally.

Cybersecurity Threats Statistics

• AI-driven malware (43.4%) – Intelligent malware that adapts and evades detection, becoming the top cybersecurity concern for 2025.
• AI-enhanced password cracking (39.2%) – Attackers use AI to speed up password guessing and exploit weak credentials.
• Ransomware as a Service (38.4%) – Cybercriminals rent ready-made ransomware kits, fueling large-scale attacks.
• Supply chain attacks (33.6%) – Vulnerabilities in third-party vendors and software continue to pose major risks.
• Shadow IT (32.6%) – Unauthorized apps and tools used by employees increase data exposure and compliance issues.
• IoT device vulnerabilities (30.2%) – Poorly secured smart devices expand attack surfaces across industries.
• Deepfakes (27.5%) – AI-generated fake videos and voices threaten trust, identity, and information integrity.

Supply Chain Attack Statistics

• 30 % of breaches now involve third‑party or supply chain vectors.
• U.S. supply‑chain breach cost averages US $10.22 million.
• Malicious open‑source packages grew by 1,300 %.
• 26 supply‑chain attacks per month occurred in 2025.
• Breaches via trusted vendors show longer dwell times.
• Annual global cost of these attacks: US $60 billion.
• SolarWinds Orion remains a pivotal example.
• SBOMs and transparency demands are rising.

Advanced Persistent Threat (APT) Statistics

• Industrial espionage via APTs rose in Q4 2024–Q1 2025.
• 150 % increase in China‑nexus APT activity.
• Critical infrastructure saw targeted APT activity.
• APTs now operate like professional cyber businesses.
• APT motives now blend espionage and financial theft.
• Sectors targeted include telecom, energy, and software.
• Dwell times for APTs stretch across months.
• 66 % of APAC incidents occurred in Japan.

Zero‑Day Attack Statistics

• 75 zero‑day vulnerabilities were exploited in 2024.
• Average time to weaponize dropped to 5 days.
• 44 % of exploits target enterprise appliances.
• Zero‑days are initial vectors in major breaches.
• 21,500+ CVEs disclosed in H1 2025.
• Microsoft remains a top zero‑day target.
• Exploit market value rose 44% annually.
• Virtual patching is now essential.

Hacking Statistics

• Hackers benefit from automated toolkits and kits for sale.
• Credential reuse and misconfigurations remain top attack paths.
• Small orgs bear disproportionate costs.
• IoT and cloud enable lateral movement.
• Phishing leads to data exfiltration and extortion.
• Human weaknesses are primary targets.
• AI is making hacking scalable and targeted.

Cloud Security and IoT Threats

• 35.2 billion connected devices are projected in 2025.
• 36,000 scans per second target devices.
• 471 million web‑based attacks blocked in Q2 2025.
• 8% of attacks exploit default credentials on IoT.
• 820,000+ IoT/OT attack attempts daily.
• 46% rise in OT‑targeted malware.
• 27% of ICS/OT decisions are made at the C‑suite level.
• 37% share IT/OT budgets, 26% OT owned budgets.
• Only 9% of professionals work full‑time on OT security.

Industry‑Specific Cybersecurity Statistics

• Healthcare breaches cost over US $9 million.
• Manufacturing sees 30% higher incident rates.
• Financial firms see 70% of breaches involve cloud.
• Utility budgets rose 15% year‑over‑year.
• 49% of education/public orgs lack cybersecurity talent.
• 46% of retail incidents start via IoT or POS.
• 38% of energy firms allocate 26–50% of their cyber budget to OT.
• 54% of telecoms cite supply chain as top concern.

Cybersecurity Risks for Small and Medium‑Sized Businesses

• 65% of SMBs view AI as vital to cybersecurity.
• Only 15% use professional IT/MSSP resources.
• 50% use antivirus, 47% network scanning, 44% firewalls.
• SMB breach costs are 13.4% higher than average.
• 4.8 million cybersecurity jobs are unfilled globally.
• 9 in 10 hiring managers demand prior IT experience.
• Understaffed SMBs face US$5.74 million average breach costs.
• 30% of SMB incidents start via a third party.

Workforce Shortages and Skills Gap

• Cybersecurity workforce: 5.47 million, up 0.1%.
• Shortfall: 2.8–4.8 million globally.
• 52% of leaders say skills, not people, are the issue.
• 37% of orgs saw budget cuts, 25% layoffs in 2024.
• High skills gap: breach costs average US $5.74 million.
• U.S. talent supply meets 26% of demand.
• 55% use internships, 46% apprenticeships for hiring.
• 3.4 million gap in APAC, 500,000+ in U.S.

Cybersecurity Spending and Budgets

• US $213 billion forecasted for 2025 spending.
• 78% of orgs expect cyber budgets to increase.
• 36% prioritize AI, followed by cloud and network security.
• 12% of U.S. firms allocate most budget to OT security.
• Security software spending grows from US $95 billion.
• Budget growth slowed to 4% in 2025.
• 65% of SMBs see AI as critical for managing cyber functions.
• “Security budget gap” is widening.

Impact of Artificial Intelligence (AI) on Cybersecurity

• 78% of CISOs report AI‑powered threats affect them.
• 64% of orgs deploy AI for detection.
• AI reduces containment time to 214 days from 322.
• 36% made AI their top cyber investment.
• Only 37% vet AI tools for cyber risk.
• AI market in security to reach US $60.6 billion.
• AI saves US $1.76 million per breach.
• Infostealer malware rose 180% via AI.
• AI arms race: attackers vs defenders.

Future Predictions and Emerging Threats

• Cybercrime could exceed US$10 trillion by 2027.
• Fraud from AI deepfakes to rise 4× by 2027.
• 65% of tasks will be AI‑managed by 2028.
• 100+ zero‑days will be exploited annually by 2026.
• 40%+ of breaches from cloud and supply‑chain by 2027.
• OT attacks are expected to cause hundreds of physical downtimes by 2028.
• Skills gap may hit 6 million+ by 2030.
• AI‑governance failures cost up to US $4 million more.

Frequently Asked Questions (FAQs)

Conclusion

As we look toward 2025 and beyond, the cybersecurity landscape is marked by expanding threats, complex attack surfaces, and new technology‑driven dynamics. From the growth of IoT and cloud platforms to the transformative impact of AI on both attack and defense, organisations must adapt or risk falling behind. The constraints of talent, budget, and governance add further urgency, especially for smaller businesses and infrastructure‑heavy industries. Ultimately, actionable awareness, targeted investment, and skills alignment will determine which organisations withstand the cyber‑storm. Dive into the detailed statistics and analyses above to equip your strategy for what lies ahead.